Everything Is a Plugin

anti-slop coding open source

Fifteen opinionated Oxlint rules that reject low-evidence TypeScript and JavaScript: chained type assertions, `unknown` parameters and returns, runtime `typeof` checks, module mocking, widen-then-assert. It is meant to be vendored rather than depended on — an agent skill copies the plugin in, merges the lint config, and then the files are yours to edit.

Every one of these rules is a review comment somebody is tired of writing. Moving them into the linter means the argument happens once, at config time, instead of in every pull request — and the ignore list, which names ten different agent directories, tells you exactly which authorship problem the rules were written for.

OpenBot infra open source

CopilotKit's agent platform for your own infrastructure: Docker Compose brings it up, data sits in your Postgres, no model ships in the box, and the admin's credential is encrypted at rest. Each bot gets a computer of its own — a real browser with its own logins, its own files, and only the tools you grant — and anything it does to a computer, file, or MCP server passes through a single gateway that decides before and records after. Any AG-UI agent can be dropped in as a coworker.

Per-agent isolation plus one auditable chokepoint is the same shape the serious infrastructure keeps converging on, and here it is as MIT alpha you can run on a laptop. It is early enough that the README says so twice, so treat it as the architecture to read rather than the thing to depend on.

Cumora productivity open source

Cross-platform team chat — Electron, PWA, iOS, Android — where agents sit on the same roster as humans, with personas and memory, their own DMs, a shared Kanban board and calendar, and real email in and out. Brains come from either managed per-agent pods on the OpenAI Responses API or BYOA, where `npx cumora agent computer` pairs your own Mac or VPS and the agent runs on your local Claude Code or Codex; the server never sees your provider keys.

2.7K stars in the three days since it appeared, and the BYOA path is the interesting half: your subscription, your machine, their interface. Whether agents belong in the team chat or in a queue somewhere is still an open argument, but this is the most complete answer anyone has shipped to the first option.

404 Media hid a tracker in a rare book and followed it to VGT3, a section of an Amazon facility in Las Vegas where, workers say, bindings are cut off so the pages scan faster. The team's logo is a dinosaur holding a book. Training-data provenance is usually argued in the abstract; this is what one end of the pipeline physically looks like.

Jeremy Morrell's case for reopening plugin architectures: 'LLMs radically lower the cost of authoring extensions, and modern sandbox primitives lower the deployment cost and provide good security boundaries.' Both halves had to arrive for this to work, and the second half is the one people forget — a user-written extension is only a good idea if the thing running it cannot be talked into anything.

Willison had Claude Fable 5 evaluate smolvm for running user-supplied transforms: CPU and RAM caps, no network, read-only inputs and a writable output directory, cold starts of 0.6–1.5s and warm runs around 50ms. When Claude Code turned out to lack nested virtualisation, the agent moved the test suite onto GitHub Actions runners to get the numbers — the research repo is the useful artefact, and the workaround is the tell.

A 27B vision model under Apache 2.0 that scores 52 on the Artificial Analysis index — level with GPT-5.6 Luna, from a 17GB Q4_K_M file. Willison ran it at 15–30 tokens/sec on an M5 Max and found the catch: it defaults to `xhigh` reasoning and burned 22,276 reasoning tokens over 21 minutes on a prompt that took two minutes with reasoning off. Turn the dial down before you judge it.

Shipped 14 August on the identical 743B MoE base as GLM-5.2, with every claimed gain coming from scaled-up post-training: Terminal-Bench 3.0 at 28.3 against 4.6, DeepSWE at 66.9%, CyberGym at 84.5%. Weights are promised around the end of the month, which means nobody outside Z.ai has reproduced any of it yet — read the table as a vendor claim until they land.

The compiler and toolchain went out under Apache 2.0 on 18 August, closing a promise made in May 2023 and arriving after Mojo 1.0. The language that got there is not the one that was pitched — full Python compatibility was dropped last August in favour of a Python-flavoured language aimed squarely at GPU programming, with migration handled by tooling rather than by the type system.